CVE-2026-93103

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

CVE-2026-93104 RDMA/rvt: Return NULL after port allocation failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvtallocdevice deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as val...

CVE-2026-93103

CVE-2026-93103 affects the Linux kernel in the RDMA/hfi1 driver. The root cause is that hfi1_free_devdata() unconditionally erases dd->unit from the unit table, assuming the device was successfully inserted. If xa_alloc_irq() fails, the zero-initialized unit remains at index 0, meaning cleanup...

CVE-2026-93103 RDMA/hfi1: Preserve unit 0 on allocation failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

CVE-2026-93103 RDMA/hfi1: Preserve unit 0 on allocation failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

CVE-2026-93104

CVE-2026-93104 is a use-after-free in the Linux kernel 's RDMA/rvt subsystem. The function rvt_alloc_device() deallocates the IB device when its port array allocation fails, but then returns the pointer to the already-freed allocation. Callers treat any non-NULL return value as valid and derefere...

EUVD-2026-82211

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

CVE-2026-93104

In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvtallocdevice deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as val...

EUVD-2026-82210

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

CVE-2026-93102 RDMA/hfi1: Free RX data on late probe failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

CVE-2026-93102 RDMA/hfi1: Free RX data on late probe failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

CVE-2026-93102

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

CVE-2026-93102

CVE-2026-93102 affects the RDMA/hfi1 driver in the Linux kernel. The root cause is a resource leak: hfi1_init_dd() allocates shared AIP/VNIC RX support, but if hfi1_init() or hfi1_register_ib_device() subsequently fails, init_one() tears down device data without calling hfi1_free_rx() , leaking n...

CVE-2026-93100

CVE-2026-93100 is a use-after-free in the Linux kernel's fs/resctrl subsystem. The race occurs between rdtgroup_kn_put() (which decrements waitcount via atomic_dec_and_test() outside rdtgroup_mutex) and bulk teardown paths (free_all_child_rdtgrp() / rmdir_all_sub()) that hold the mutex. A concurr...

CVE-2026-93100 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Prevent use-after-free in rdtgroupknput A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep while waiting on acquiring rdtgroupmutex take a...

CVE-2026-93101 media: v4l2-async: Unregister sub-device if asc_list is empty

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

CVE-2026-93101

CVE-2026-93101 affects the Linux kernel's v4l2-async media subsystem . The root cause is that v4l2_async_unregister_subdev() fails to call v4l2_device_unregister_subdev() when a sub-device's asc_list is empty. This occurs in a corner case where the tvp5150 i2c driver (which uses v4l2_async) is pa...

CVE-2026-93101

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

CVE-2026-93101 media: v4l2-async: Unregister sub-device if asc_list is empty

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

EUVD-2026-82208

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Prevent use-after-free in rdtgroupknput A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep while waiting on acquiring rdtgroupmutex take a...